CASL条件匹配器不生效及权限校验失效问题求助

问题情况 #

我编写了CASL能力工厂代码，使用基础条件{ authorId: user.id }时抛出错误：

You need to pass "conditionsMatcher" option in order to restrict access by conditions

添加conditionsMatcher: buildMongoQueryMatcher({})后错误消失，但条件校验失效，用户可以编辑他人帖子。尝试改用createMongoAbility后问题依旧，更新后的代码也没能解决问题。

原始代码 #

type Subjects =
  | InferSubjects<
      | typeof Post
      | typeof User
    >
  | 'all';

export type AppAbility = PureAbility<[Action, Subjects]>;

@Injectable()
export class CaslAbilityFactory {
  createForUser(user: Partial<User>) {
    const { can, build } = new AbilityBuilder<PureAbility<[Action, Subjects]>>(
      PureAbility as AbilityClass<AppAbility>,
    );

    if (!user.emailVerified) {
      // 未验证用户的基础权限
      can(Action.Read, 'all');
      can([Action.Update, Action.Delete], User, { id: user.id });
    } else {
      // 已验证用户权限
      can([Action.Create], Post);
      can([Action.Update, Action.Delete], Post, { authorId: user.id });
    }

    if (user.role === UserRole.MODERATOR) {
      // 版主额外权限
      can([Action.Update], Post);
    }

    if (user.role === UserRole.ADMIN) {
      // 管理员拥有全部权限
      can(Action.Manage, 'all');
    }

    return build({
      detectSubjectType: (item) =>
        item.constructor as ExtractSubjectType<Subjects>,
    });
  }
}

更新后的尝试代码 #

const conditionsMatcher = buildMongoQueryMatcher({ $ne, $nor, $eq }, { ne, nor, eq })

@Injectable()
export class CaslAbilityFactory {
  createForUser(user: Partial<User>) {
    const { can, cannot, build } = new AbilityBuilder<PureAbility<[Action, Subjects]>>(
      createMongoAbility
    );
    console.log({ userId: user.id })
    if (user.role === UserRole.USER && !user.emailVerified) {
      // 未验证用户的基础权限
      can(Action.Read, 'all');
      can([Action.Update, Action.Delete], User, { id: user.id });
    } else if (user.role === UserRole.USER) {
      // 已验证用户权限
      can([Action.Create], Post);
      can([Action.Update, Action.Delete], Post, { authorId: { $eq: user.id } });
    }

    if (user.role === UserRole.MODERATOR) {
      // 版主额外权限
      can([Action.Update], Post);
      can([Action.Create], ActionVote);
    }

    if (user.role === UserRole.ADMIN) {
      // 管理员拥有全部权限
      can(Action.Manage, 'all');
    }

    return build({
      detectSubjectType: (item) =>
        item.constructor as ExtractSubjectType<Subjects>,
        conditionsMatcher
    });
  }
}

原因分析 #

1. CASL v6+的PureAbility默认无内置条件匹配器：必须显式指定条件匹配器才能处理带条件的权限规则，否则会抛出初始错误。
2. 自定义条件匹配器配置错误：手动构建buildMongoQueryMatcher时传入的操作符与CASL内部逻辑不兼容，导致条件校验失效。
3. 泛型类型不匹配：使用createMongoAbility时，AbilityBuilder的泛型仍指定为PureAbility，类型不一致导致权限规则无法正确应用。
4. 主体类型检测逻辑缺陷：detectSubjectType仅返回item.constructor，当传入的是类而非实例时，无法正确识别主体类型，导致条件规则不生效。

解决方案 #

1. 对齐类型与内置匹配器 #

使用createMongoAbility的默认条件匹配器，同时确保AbilityBuilder的泛型与创建的能力类型一致。

2. 修正主体类型检测逻辑 #

兼容实例和类两种场景，确保CASL能正确识别主体类型。

3. 简化条件规则写法 #

直接使用{ authorId: user.id }而非{ authorId: { $eq: user.id } }，CASL会自动转换为对应的Mongo查询条件。

修正后的完整代码 #

import { AbilityBuilder, createMongoAbility, ExtractSubjectType, InferSubjects, AbilityClass } from '@casl/ability';
import { Injectable } from '@nestjs/common';
// 替换为你的实际模型和枚举路径
import { Post, User, UserRole } from './models';
import { Action } from './action.enum';

type Subjects =
  | InferSubjects<typeof Post | typeof User>
  | 'all';

// 使用createMongoAbility的返回类型作为AppAbility
export type AppAbility = ReturnType<typeof createMongoAbility<[Action, Subjects]>>;

@Injectable()
export class CaslAbilityFactory {
  createForUser(user: Partial<User>) {
    // 泛型指定为AppAbility，与createMongoAbility对齐
    const { can, build } = new AbilityBuilder<AppAbility>(createMongoAbility as AbilityClass<AppAbility>);

    if (!user.emailVerified) {
      can(Action.Read, 'all');
      can([Action.Update, Action.Delete], User, { id: user.id });
    } else if (user.role === UserRole.USER) {
      can([Action.Create], Post);
      // 简化条件写法
      can([Action.Update, Action.Delete], Post, { authorId: user.id });
    }

    if (user.role === UserRole.MODERATOR) {
      can([Action.Update], Post);
      can([Action.Create], 'ActionVote');
    }

    if (user.role === UserRole.ADMIN) {
      can(Action.Manage, 'all');
    }

    return build({
      detectSubjectType: (item) => {
        // 兼容实例和类的情况
        return (item.constructor || item) as ExtractSubjectType<Subjects>;
      },
      // 使用createMongoAbility的默认条件匹配器
      conditionsMatcher: createMongoAbility.defaultConditionsMatcher
    });
  }
}

验证要点 #

• 检查权限规则顺序：管理员权限放在最后，确保能覆盖前面的规则
• 测试时传入Post实例而非类，确保detectSubjectType能正确识别
• 验证普通用户只能编辑自己的帖子，版主可以编辑所有帖子，管理员拥有全部权限

内容的提问来源于stack exchange，提问作者VIVID